New Approach to Quantum Key Distribution Via Quantum Encryption 
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In this Paper, we investigate tlie security of Zliang, Li and Guo quantum key distribution via quantum encryp- 
tion protocol [Pliys. Rev. A64, 24302(2001)] and sliow tliat it is not secure against some of Eve's attacks and 
witli tlie probability one half she gets all of keys without being detected by the two parties. The main defect in 
this protocol is that there is an attack strategy by which Eve can change the previously shared Bell state between 
Alice and Bob to two Bell states among herself and Alice and Bob. Hence, we show that with probability 1/d 
its generalization to d-dimension systems is not secure and show that its extension to the case of more partners 
based on the reusable GHZ states is not secure and with probability one half Eve gets all of keys without being 
detected by the two parties. In what follows, we show how in going to higher dimensions those protocols can 
be repaired. 

PACS numbers: 03.67.Dd, 03.65.Ud 



I. INTRODUCTION 

In a cryptography protocol, we discus the possibility that 
two remote parties, conventionally called Alice and Bob, ex- 
change a secret random key to implement a secure encryption- 
decryption algorithm, without meeting each other. Once the 
sharing is achieved, the two parties can secretly exchange a 
message over the public channel by encrypting them with a 
key with a length equal to the message. In the key distri- 
bution with classical transmission lines, an eavesdropper can 
freely sneak into the transmissions and monitor the informa- 
tion. Thus the role of cryptography is to provide some math- 
ematical procedure that makes it computationally difficult for 
the eavesdropper to reproduce the key from the information 
sent through the transmission lines. However, no existing 
classical cryptosystems has proven to present sufficient diffi- 
culty to an eavesdropper In particular, it was shown that some 
of them can be broken in principle by quantum computation 

a. 

On the other hand, quantum mechanics (QM) and its funda- 
mental concepts were previously restricted to clarify and de- 
scribe very special issues of physics. Recently, these concepts 
have been extensively used in such concrete problems as the 
distribution of secure keys between two parties. In 1984, Ben- 
nett and Brassard |2] proposed a way of distributing the keys 
in a physically secure way, by using quantum physics. Their 
protocol bears the acronym BB84, and was the first protocol 
of quantum cryptography, but we shall use the more precise 
name of quantum key distribution (QKD). 

In 1991, Ekert |3;] proposed a QKD protocol that used en- 
tangled particles, and he stated that the violation of Bell's in- 
equality might be the physical principle that ensures security. 
In the quantum mechanical approach to key distribution, se- 
curity is based on the laws of QM and not on the unproven 
complexity of a mathematical problem, as was the case with 
the classical cryptography. In these protocols eavesdropping 
by an Eve has been considered, and it has been shown that 
they are secure against various types of Eve's attacks (for a 
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comprehensive review see 0]). 

After the earlier QKD protocols, various extensions were 
proposed, for example: a key distribution protocol in which 
Alice distributes the key among N different Bobs, in such a 
way that only with the participation of all m Bobs {m < N) 
the keys could be retrieved |5]. Continuous variable key dis- 
tributions |6| are among these generalizations. QKD pro- 
tocols have been demonstrated over the past fifteen years 
through an ingenious series of experiments by several research 
groups. Many encouraging experiments have demonstrated 
QKD, some spanning more than a hundred kilometers through 
optical fibers [TJ. Hence, the possibility of a secure key distri- 
bution in the presence of noisy channels and decoherence has 
been considered [s\ . 

Recently, a new approach to QKD was proposed by Zhang, 
Li and Guo (ZLG) J^l, in which they proposed a QKD proto- 
col that uses a quantum key to encode and decode the classical 
information by considering a previously shared reusable Bell 
state which acts as the quantum key. In this paper, we show 
that their protocol is insecure against Eve's attack and with 
a probability of 1/2, Eve can be informed of Alice and Bob 
keys without being detected by them. Hence, we show that 
their extensions to higher dimension 111 Oil and quantum secret 
sharing based on the reusable GHZ states lllll . are not secure. 

This paper is organized as follows. In Sec. II we briefly 
review some properties of QKD protocols in which data ex- 
change between Alice and Bob is done, using orthogonal 
states. In Sec. Ill we review the original Zhang et al. pro- 
tocol 1 9]. In Sec. IV we show that this the protocol is not 
secure against some of Eve's attacks. In Sec. V we show that 
ZLG extension to higher dimensions, suggested by Karim- 
ipour, Bahraminasab and Bagherinezhad (KBB) 1 10] is not se- 
cure. In Sec. VI we present some modified protocols that are 
not only secure against Eve's attacks, but also our protocol has 
simple QKD steps and any eavesdropping by Eve can be de- 
tected by Alice and Bob. Hence, we show that ZLG protocol 
can be repaired, if we go to higher dimensional shared EPR 
states. In Sec. VII we show that quantum secret sharing based 
on the reusable GHZ state among three parties, suggested by 
Bagherinezhad and Karimipour (Bk) |11], is not secure and 
we repair this protocol. Finally, in Sec. VIII we summarize 
our results. 



II. QUANTUM CRYPTOGRAPHY BASED ON 
ORTHOGONAL STATES 

Security of quantum cryptosystems is guaranteed by the 
two fundamental laws of QM, (i) no-cloning theorem of non- 
orthogonal states in quantum mechanics, (ii) any measure- 
ment on a system can cause a perturbation on it (wave func- 
tion reduction). On the other hand, in addition to the above 
basic principle, in a realistic QKD protocol, we mention some 
conditions that should be satisfied by any QKD protocol. As 
suggested by M. Nielsen |12], to get the best possible cryp- 
tosystems, we need to have the following properties: 

I) The theoretical basis must be entirely public; 

II) Actual implementation should be widely and publicly 
available; 

III) There should be extended periods of testing real imple- 
mentations. 

In addition to the above conditions, any QKD protocol must 
have the following property, 

IV) If Alice and Bob detect the presence of Eve on the dis- 
tributed keys, they should discard those keys and must apply 
their protocol to other states, and in this new use of the proto- 
col they must detect the existence of Eve again. 

Although, systems obeying these properties don't necessar- 
ily have security, they have preconditions for being secure. A 
simple scheme was proposed by Bennett y|], which uses only 
two nonorthogonal states. In this method, nonorthogonal en- 
coding of the bit of information inevitably leads to the waste 
of a portion of photons. 

In contrast to these schemes that use nonorthogonal states, 
some deterministic quantum cryptography schemes, based on 
orthogonal states, have been proposed Il3l Il4l llSll . Gold- 
enberg and Vaidman (G V) 1 1 3 1 and consequently, Koashi and 
Imoto (KI) 1 14] have presented a quantum cryptography based 
on orthogonal states. The basic technique is to split the trans- 
fer of one bit of information into two steps, ensuring that only 
a fraction of the bit of information is transmitted at a time. 
Then the no-cloning theorem of orthogonal states \l&\ guar- 
antee its security. Cabello presented a protocol 1 15] based on 
GV and KI protocols and on the idea of using a larger alpha- 
bet that saturates the capacity of the quantum channel. He 
has introduced a key distribution protocol which works in the 
Holevo limit ]15]. After this paper, some people attempted 
to get Holevo limit by using another approach 1 17t,18t.l9.1 . 
Recently, some people ]20, 2lJ have used non-local variables, 
firstly introduced by Bennett et al. ]22], to propose protocols 
for QKD. These state, which are the product of two states can- 
not be distinguished through the use of local operations and 
(unlimited) classical two-way communications (LOCC). 

Hence, Zhang et al. ]9] presented another QKD scheme 
that uses a quantum key to encode and decode the classical in- 
formation, and the previously shared reusable EPR state acts 
as the quantum key. They called it channel encrypting QKD. 
This protocol can be used for quantum secure direct commu- 
nication, and was proposed and pursued by some groups ]23]. 

One of the best properties of QKD with orthogonal states 
is that we don't use any classical communication (although, 
earlier versions didn't have this property), because of the lack 



of classical communications. Eve has minimum information 
about the secret keys that are shared by Alice and Bob. Hence 
in this protocol, we make use of the total dimension of Hilbert 
space. Thus, the security of protocol can be enhanced. In what 
follows, we restrict ourself to protocols haveing no decoher- 
ence effects and in which all of the parties and eavesdropping 
operations are exact and the environment doesn't interact with 
our system. 



III. ZLG PROTOCOL 

In the Zhang et al. protocol ]9], Alice and Bob have pre- 
viously shared some quantity of the Bell pairs, serving as the 
quantum key 
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When the process begins, the two parties rotate their particle's 
state by angle 6, respectively. The rotation can be described 

by 
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The state 1$+) does not change under bilateral operation of 
R{9). The purpose of this operation is to prevent the other 
parties from eavesdropping. Then Alice selects a value of a bit 
(0 or 1) and prepares a carrier particle 7 in the corresponding 
state 1-0) (|0) or |1)), randomly. The classical bit and the state 
10) are only known by Alice herself. Alice uses the particle 
A of the entangled pairs and 7 in state ji/') to do a controlled- 
NOT (cnot) operation {A is the controller and 7 is the target) 
and the three particles will be in a GHZ state 

I*) = -1[|000)ab7 + |lll)Ai37]> when |0) = |0)(3) 

or 

I*) = ^[|001)ab7 + |110)as7]' when |i^) = |1)(4) 

Then, she sends 7 to Bob. Bob uses his corresponding particle 
S to do a CNOT operation on 7 again (B is the controller and 
7 is the target). Now the key particles A and B and the carrier 
particle 7 are in the same state as the initial state: 
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Bob measures 7 and gets the classical bit corresponding to 
the state j?/;). Zhang et al. considered some of Eve's eaves- 
dropping strategies, for example, they showed that Eve can 
intercepts the particle 7 that Alice sends to Bob and uses her 
own particle (in the states |0) or |1)) to do a CNOT operation 
(her own particle is the target and 7 is the controller). Then, 
Eve sends 7 to Bob. After Bob's decoding operation. Eve's 
particle is entangled with the key. It seems that Eve can use 
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FIG. 1 : A F-type attack on ZLG protocol for quantum encryption of 
keys, (a) With the choice of appropriate bases, Eve can change the 
previously shared Bell pairs |<I>"^)as between Alice and Bob to (b) 
two similar Bell states between her and Alice and Bob (b). 



her particle to decode Alice's particle as Bob does. To de- 
tect this eavesdropping strategy, they suggested that Alice and 
Bob should do a bilateral rotation R{9) on the key (EPR pairs 
in the state 1$+)) before Alice does the CNOT operation for 
second 7 particle. Zhang et al. showed that the error rate 
of the bit that Ahce sends to Bob will be 2 cos^ 9 sin^ 9. So 
if 9 = J, the error rate caused by eavesdropping will reach 
i. Then they concluded that communication parties can se- 
lect 9 = J as the bilateral rotation angle in every round and 
Eve cannot get any useful information of the bit string they 
transmit. Then, they considered a more realistic quantum op- 
eration and transition through noisy channels and showed that 
their protocol was robust. 



IV. EVE'S ATTACK 

In this section, we would like to show that ZLG protocol is 
not secure against the use of a special strategy for eavesdrop- 
ping. 

The eavesdropping strategy is illustrated in Fig.Q. 
According to Fig.Q, if Eve can transform previously 
|'i'^)AS between Alice and Bob to 
I*,) are Bell states: 



shared entangled state 

|*^)a£;|*«)_eb, where 



$=^) == |00>±|11) 



then, she can take all of keys that Alice sends to Bob. Here, we 
consider a simple case that the rotating angle by Alice and Bob 
for the security of QKD protocol is equal to 9 = ^, as a choice 
by ZLG protocol (with a simple change in our approach, it can 
be applied to any arbitrary rotation angle 9; although, some 
authors consider Hadamard transformation for their operation 
in higher dimensions fl(j] and more than two parties llllll V 
Eve's strategy can be described as follows: 

1) Ahce uses the particle A of the entangled pairs and 71 
in state \tp) (|0) or |1)) to do a CNOT operation (A is the con- 
troller and 71 is the target) and the three particles will be in a 
GHZ (eqs.|3ll3l state. Then, she sends 71 to Bob. 

2) Eve intercepts particle 71 and does a measurement in 
the z bases (jO), |1)) on it. Eve knows that Alice and Bob 
entangled states \^^)ab reduce to |00)ab or |1 1)^15. 

3) Eve sends a particle 71 to Bob. Bob uses his correspond- 
ing particle i? to do a CNOT operation on 71 {B is the con- 
troller and 7i is the target). Bob measures 71 and will get the 
classical bit corresponding to the state \ip). Alice and Bob can 
not detect Eve's operation in this step. 

4) Alice and Bob apply the operation of R{j) on the their 
particles states. Alice chooses another particle 72 (|0) or |1)) 
and does a CNOT operation on it {A is the controller and 72 is 
the target), and sends 72 to Bob. 

5) Eve intercepts and keeps particle 72 to herself. Thus, Eve 
has a share on the Bell state between herself and Alice. 

6) Eve prepares a maximally entangled state |<l>^)i,2 and 
sends particle 2 to Bob. At this stage, the common state 
among them is: 



|vI/i) = (|00)-|ll)W(|00) + 
for |<1>^)ab reduces to |1 1)^43 and 

|vI/2)-(|01)-|10)U^,(|00) + 
for |<I'^)a_b reduces to |00)yis and 

|vi/3) = (|oo) + |ii)U^,(|oo) + 

for \^^)ab reduces to |00)yis and 
|vI/4) = (|01) + |10))a^,(|00) + 



11))i,2(|0)-|1))b 
72) = |l>,or 
11))i,2(|0)-|1))b 
72) = |0), or 
11»i,2(|0) + |1))b 
72) = |l),or 

11))i.2(|0) + |1))b 
72> - |0> 
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for \^^)ab reduces to |11)as and 

7) Bob takes particle 2 and uses particles B and 2 to do a 
CNOT operation {B is the controller and 2 is the target). Here, 
common state is: 



or 



or 



1*1) = (|00) - |11))a^,{(|00) - |ll»is|0)2 + (|01> - |10))is|l>2} 



IVI/2) = (|01) - |10))a^,{(|00) - |11»ib|0)2 + (|01> - |10»ib|1>2} 



\^,) = (|00) + |11))a^,{(|00) + |ll))is|0)2 + (|01> + |10»ib|1>2} 



|vI/4) = (|01) + |10)U^,{(|00) 



|11))ib|0)2 + (|01) + |10))ib|1)2} 
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8) Bob does a measurement on the particle 2 in the z bases 
(|0), |1)). With the probability of one-half, the above states 
reduce to: 



or 



or 
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At this stage. Eve shares two similar Bell states between her- 
self on the one hand, and Alice and Bob on the other hand. 
Thus, for the next rounds of the protocol Eve can take all of 
keys that encrypted by Alice to \'^) A-t^ state and she sends 
those keys to Bob by encryption to |V')ib, without being de- 
tected by them. 

9) For the next rounds of the ZLG protocol, in the cases 
of l^i). Eve gets the results |7„ + 1) (|7n)) for n odd (even) 
sequences of Alice and Bob results and viceversa for [^4). 
Hence, in the case of |\1'2) (j^a)). Eve gets the results of 
\ln + 1) (|7n)) for all of n sequences of Alice and Bob results. 
However, when Alice and Bob compare a subsequence of the 
data bits publicly to detect eavesdropping. Eve leaks useful 
information for correcting her results. More specifically, for 
any odd (even) numbers of data bit that is announced by Alice 
and Bob, Eve can determine which of the four possible |^i) 
states is common among them. By this means. Eve can obtain 
all of numbered data bits completely, without being detected 
by Alice and Bob. 

10) Thus, with the probability \, Eve can get favorable re- 
sults. In other cases (with the probability i), the Alice and 
Bob can detect Eve's attack. In other word, in any two rounds 
of the experiment. Eve can hope to get keys in one of them. 

Recently, Gao et al. JH (GGWZ) showed that ZLG pro- 
tocol and its extensions are not secure. They presented an 
eavesdropping strategy which allows Eve to obtain half of the 
data bits without being detected by the communicating par- 
ties. Thus, they concluded that use of Hadamard gate or rota- 
tion by 6* = ^, on each shared qubit is not effective in prevent 
eavesdropping. This eavesdropping strategy is very simple 
and Alice and Bob can detect the effect of Eve by a simple 
change of their protocol. As authors suggested their eaves- 
dropping can be removed by the choice of another rotation 
angle for R{0) (9 7^ j), by Alice and Bob. Hence, the parties 
can consider other states such as: 
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as the carrier state in the ZLG protocol, where a and (3 are real 
variables with the properties: a 7^ /?, a, /3 ^ and a^ + /3^ = 
1. Their protocol would be secure against of GGWZ attack 
12411 and Alice and Bob can use Hadamard or R{9) = ^ as 
their operations. If we follow the ZLG protocol with the above 
set of states, after Alice operation (by choosing t/iq as carrier), 
we have: 
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This state has an interesting property: carrier states corre- 
sponding to states 1 00) and |11) are not orthogonal to each 
other, and Eve can not perfectly entangle her state to those of 
Alice and Bob. Thus, for every round of the protocol. Eve 
makes some errors on parties' measurement results. With at- 
tention to the aforementioned strategy for the protection of the 
ZLG protocol against the GGWZ attack, in the following, we 
don't consider this eavesdropping strategy for our proposed 
protocols which repair ZLG, KBB and Bk protocols. 

Hence, it is not complicated to show that, in our approach 
to Eve's eavesdropping strategy, it is not important whether 
Alice and Bob take an arbitrary rotation angle 9 or use states 
of equation (6). In both cases. Eve can still take an appropri- 
ate rotation angle and measurement bases that help her to do 
eavesdropping. 



V. QUANTUM KEY DISTRIBUTION FOR D-LEVEL 
SYSTEMS WITH GENERALIZED BELL STATES 



Recently, Karimipour et al. lllCl extended ZLG protocol to 
d-level systems. Their protocol is based on shared entangle- 
ment of a reusable Bell state. The security against some indi- 
vidual attacks is proved, where the information gain of Eve is 
zero and the quantum bit error rate (QBER) introduced by her 
intervention is {d — l)/d. However, in this section we show 
that Eve can attack by a special strategy to get, with probabil- 
ity 1/d, all of keys without being detected by Alice and Bob. 
For convenience, we use the same notations as in [10]. Let 
us first give a brief description of the QKD protocol involved 
here. At the beginning, Alice and Bob share a generalized 
Bell state: 
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The qudit to be sent is denoted by q, which is encoded as a 
basis state \q)k- They defined controlled-right and controlled- 
left shift gates that play the role of controUed-NOT gate, and 



act as follows: 

Rc\hj) = \i,j + i), Lc\i,j) ^\i,j -i) {mod d) (9) 

Alice performs a controlled- right shift on \qi)k and thus en- 
tangles this qudit to the previously shared Bell state, produc- 
ing the state: 
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j=o 



Then, she sends the qudit to Bob. At the destination. Bob 
performs a controlled-left shift on the qudit and disentangles 
it from the Bell stae, hence revealing the value of q with 
certainty. To protect this protocol against a specific kind of 
attack, Alice and Bob proceed as follows. Before sending 
each of the qudits, Alice and Bob act on their shared Bell 
state by the Hadamard gates H and H*, which are defined as 

H — -7^ X]fc ;=o ^^'^'10(^1' I'ssps'^'^i'^sly- The key point is 
that a Bell state |V'o,o) disentangled from the outside world is 
unchanged under this operation, while a state entangled with 
outside is not: 



H (g> H*\ijo,^o) = Hofi) 



(11) 



Eve's strategy is similar to that in the previous section and 
can be described as follows: 

1) Alice uses the particle a of the entangled pairs and qi in 
state I gi) to do a controlled- right shift on it to produce the 
state (eq. llOt . Then, she sends qi to Bob. 

2) Eve intercepts particle qi and does a measurement in the 
z basis on it. Eve knows that Alice, Bob and particle qi states 
reduce to \j, j, qi + j)a,b,k where j = 0, ...d - 1. 

3) Eve sends particle qi to Bob. Bob uses his corresponding 
particle 6 to do a controlled-left shift on the qi. Bob measures 
qi and gets the classical dit corresponding to state the \qi). At 
this stage, Alice and Bob can not detect Eve's operation. 

4) Alice and Bob apply the operations H and H* on the 
their particle states. 
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5) Alice chooses another particle 52 and performs a 
controlled- right shift on \q2)k and sends 52 to Bob. 
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6) Eve intercepts and keeps particle (72 to herself, thus. Eve 
has a share on the Bell state between herself and Alice. Eve 
prepares a maximally entangled state -y= J2i=o 1^' '^)i.2 and 
sends particle 2 to Bob. 



7) Bob takes particle 2 and uses particles b and 2 to do a 
controlled-left shift on it 
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Bob does a measurement on the particle particle 2 in the z ba- 
sis. With the probability of 1/d, we have q2 — k — I. Thus, at 
this stage. Eve shares two similar Bell states between herself 
on the one hand and Alice and Bob on the other hand. 
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8) For the next rounds of KBB protocol, in the case of the 
above state. Eve gets the results |(7„ — j) (\qn~ 92)) for n odd 
(even) sequences of Alice and Bob results for fix amount of 
j — 0, ...d — 1 and q2 = 0, ...,d — 1. However, when Al- 
ice and Bob compare a subsequence of the data dits publicly 
to detect eavesdropping. Eve leaks useful information for cor- 
recting her results. More specifically, for any odd (even) num- 
bers of data dit that is announced by Alice and Bob, Eve can 
determine which of the d possible states is common among 
them. By this means. Eve can obtain all of numbered data dits 
completely without being detected by Alice and Bob. 

9) Thus, with the probability ^, Eve can get favorable re- 
sults. In other cases (with the probability ^^), Alice and Bob 
can detect Eve's attack. 



VI. NEW AND SECURE ENCRYPTION PROTOCOL 

In the preceding section, we showed that ZLG protocol for 
EPR pairs acting as the quantum key to encode and decode the 
classical cryptography is not secure against a specific eaves- 
dropping attack, the F-type attack. In this section we suggest 
three modified protocols which are secure against F-type at- 
tack. Those protocols have some basic properties, a) the pre- 
viously shared Bell state is the main element of protocol, b) 
Alice and Bob use all Hilbert space dimension communicat- 
ing particle (7) and all rounds of the protocol, c) parties don't 
have classical communication. 

In what follows, we first suggest two QKD protocol basis 
on the reusable Bell state, but parties use classical communi- 
cation, in the tertiary protocol, we derive a efficient and secure 
QKD without classical communication. 



A. ZLG Protocol with Classical Communication 

In this protocol, we let Alice and Bob to have classical com- 
munications. The basic idea of our modification consists of 
the following steps: 

1) Alice and Bob want to share N secure bits between them- 
selves. They have previously shared some quantity of the Bell 
pairs \^^)ab- When the process begins, the two particles ro- 
tate their state by the angle 9 — j, respectively. 



2) Alice randomly selects the value of a bit (0 or 1) (to- 
taly 3A^ bits, N for message-coding and 2N for checking se- 
quences) and prepares a carrier particle 7 in the corresponding 
states \ip) (|0) or |1)). The classical bit and the state \ip) are 
only known by Alice herself. 

3) Alice randomly selects one of the following manners to 
send the qubit \ip), 

i) She uses the particle A of the entangled pairs and 7 in 
state \ip) to do a CNOT operation {A is the controller and 7 is 
the target) and calls N qbits of it message-coding and N qbits, 
checking. 

ii) She operates with a i?(^) on the particle A of the entan- 
gled pairs and takes the particle 7 in state \ip) to do a CNOT 
operation (A is the controller and 7 is the target) and calls it 
the checking (N qbit) sequence. Then, she sends 7 to Bob. 
Alice keeps the arrangement of her choices to herself. 

4) After Bob receives the particle 7 in the case of ii (check- 
ing sequence) Alice informs Bob about her R{j) operation 
and Bob operates R{j) on the his qubit B. Then, he uses his 
corresponding particle B to do a CNOT operation (B is the 
controller and 7 is the target). Bob measures 7 and gets the 
classical bit corresponding to the state jV'). They keep mea- 
surement results on 7 to themselves. 

5) In the cases (i) Alice doesn't send any classical informa- 
tion to Bob, and Bob uses his corresponding particle i? to do a 
CNOT operation (B is the controller and 7 is the target). Then 
Bob measures 7 and gets the classical bit corresponding to the 
state IV-'). 

6) After the transmission of 3A^ bit sequence, Alice in- 
forms Bob about her choices sequence for checking qubits 
{2N qubits). They compare their results to check eavesdrop- 
ping. If the error rate in this checking is below a certain thresh- 
old, then, they can take message-coding qubits {N qubits) as 
raw keys. 



B. ZLG Protocol with Direct Communication 

At this stage, we represent another protocol with the same 
result as that of the previous approach. The first and second 
steps of this protocol are similar to the previous one and we 
replace the third and fourth steps as follows: 

3') Alice randomly selects one of the following manners, 

i) She uses the particle A of the entangled pairs and 7 in the 
state \ijj) as does a CNOT operation (A is the controller and 7 is 
the target) and calls it message-coding (N qbits) and checking 
(N qbits). 

ii) She doesn't do any operation on the 7 and calls it the 
checking (N qbits) sequence. Then, she sends 7 to Bob. Alice 
keeps the arrangement of her choices to herself. 

4') After Bob receives the particle 7 in the case of ii (check- 
ing sequence), Alice informs Bob not to do any operation on 
7. Thus, Bob measure 7 and gets the classical bit correspond- 
ing to the state \ip). They keep the measurement results on 7 
to themselves. 

The fifth and sixth steps are the same as in the previous 
protocol. 



C. ZLG Protocol with the Use of Higher Dimensional Bell 
States 



In the Two previous QKD protocols, Alice and Bob re- 
stricted themselves to have two different types of states for 
security and some classical communication for some rounds 
of the protocol. At this subsection, we suggest the new proto- 
col that doesn't use classical communication (as the original 
ZLG protocol). Every repairing of ZLG protocol must have 
three basic properties, 

I) Parties don't have classical communication, 

II) Uses previously shared reusable Bell state, 

III) Uses orthogonal state as carrier. 

With the analysis of our eavesdropping attack, the main de- 
fect of ZLG protocol is the reduction of Bell pairs to product 
state by Eve's measurement on the carrier particle. Thus, we 
choose some entangled state which doesn't have this prop- 
erty. For example, we consider higher dimensional systems 
for sharing Bell states that don't reduce to a product state un- 
der Eve's measurement. 

In what follows, we need to define the controlled gate Uc 
between one qudit (as controller) and one qubit (as target). 
Similar to KBB protocol | IQ], we consider the controlled Uc 
that acts on the second qubit, conditioned on the first qudit, 
and defined as: 



Uc\i)d®\j)2 = \i)d(»U'\j)2 



(12) 



In the above relation subscripts of the state vectors represent 
the dimension of Hilbert space corresponding to each particle, 
and U — (Jx for the spin half target particles. Thus, for i even 
(odd) target state changes to \j)2 {\j + 1)2)- 

In our protocol, Alice and Bob have previously shared some 
quantity of the Bell pairs, serving as the quantum key 



n-i 



1^0,1 



^vB^y^ 



])ab 



(13) 



J=0 



When the process begins, the two parties operate Hadamard 
gate on the their particle's state which were defined in the sec. 
III. The state \ipofi) does not change under a bilateral opera- 
tion. Then Alice selects a value of a bit (0 or 1) and prepares 
a carrier particle 7 in the corresponding state \q) (|0) or |1)), 
randomly. The classical bit and the state \q) are only known to 
Alice herself. Alice uses the particle A of the entangled pairs 
and 7 in state \q) to do a controlled gate Uc operation and the 
three particles will be in state 



l*) = 






(14) 

Then she sends 7 to Bob. Bob uses his corresponding particle 
S to do a controlled gate Uc operation on 7 again. Now the 
key particles A and B and the carrier particle 7 are in the same 
state as the initial state: 



I*') = IV^o,o)ab <» |g)' 



(15) 



Bob measures 7 and gets the classical bit corresponding to the 
state \q). 

At the intermediate stage of ea.( ll4t . if Eve intercepts par- 
ticle 7 and does a measurement in the z basis (|0), |1)) on 
it, |*o,o)Ai3 reduces to iV'Syj'") = Ej,,„.=o li' J)^b °i" 
iV'o^cf) = Y.j,^^=i\JJ)ab- Thus, Eve can't disentangle 
Alice and Bob states, if Alice and Bob apply Hadanmard 
transformation on the their states (for example we consider 
iV'o^o^")), we have: 

i/®i/*|Vo:o") =E^('"^)I^1'^2)as (16) 

11.12 

In the above equation A{li,d) — d{li — I2) + 5{li — I2 — 
d) + 5{li — I2 + d) and we restrict ourselves to D = 2d (even 



dimensional Hilbert space). Thus, the above state reduces to 

El \l)A[\l)B + \l + d)B + \l-(^B] = El \l)AmB + 2\l + d)B]. 

By noting the above state. Eve can do any operation on the 
carrier state 7, for every cases. Alice and Bob have a chance 
to detect Eve's operation in the next rounds of protocol. From 
the aforementioned reasons, we can deduce that the F-attack 
does not apply to this approach. Eve can only entangle her 
state with Alice and Bob states and she wishes that after her 
operation and parties operation, Alice and Bob can not detect 
her effects. This strategy is the same as GGWZ attack which 
we have shown to be removable easily. 

Generalizing this approach to the KBB protocol is simple, 
we consider carrier states in the fc-dimensional Hilbert space 
and shared Bell state in the _D-dimensional Hilbert space. We 
divide the _D-dimensional Hilbert space to k sections, where 
any section has d elements (D = kd), similar to KBB proto- 
col. Alice performs a controUed-right shift on \ri)k and thus 
entangles this qudit to the previously shared Bell state, pro- 
ducing the state; 



I*) = ;^ ] H lio,Jo)|ri + Jo) + - + ^ li»,J»)ki + j<) + - + J2 \Jk-uJk~i)\ri +Jk-i) 

[ jo ji jk-1 



(17) 



In the above relation, |ri + ji) calculated at mod k and 
summation on the ji represent one set of j's which run as 
{i,i + k,...,i + {d - l)k} (0 ^ i ^ fc - 1). Alice then 
sends the qudit to Bob. At the destination. Bob performs a 
controlled-left shift on the qudit and disentangles it from the 
Bell state, hence revealing the value of q with certainty. Simi- 
lar to the usual manner, Alice and Bob act on their shared Bell 
state by the Hadamard gates H and H*. 

At the intermediate stage of eq.dTTt. If Eve intercepts parti- 
cle r in the intermediate cases and does a measurement in the 
z base on it, then, |*o,o)ab reduce to \%„) = Ej^ \jiji) 
^ i ^ k ~ I. Thus, Eve can't disentangle Alice and Bob 
states and F-attack doesn't apply to this approach again. Al- 
though, Alice and Bob can not detect Eve's operation, but, 
after Hadamard transformation by parties, the shared state is 
transform to: 



I*) = J2 l^> {l^ - (^ ~ 1)^) + - + \l-d) + 10 (18) 
I 

+ \l + d) + ... + \l + {k-l)d)} 
- J2 I') il^) + 2|' + '^> + - + 2|^ + (fc - l)rf)} ■ 



VII. NON-SECURITY OF QUANTUM SECRET SHARING 
BASED ON REUSABLE GHZ STATES 

In a recent paper lUlll . Bagherinzhad and Karimipour (BK) 
proposed a quantum secret sharing protocol based on reusable 
GHZ states. The security against both intercept-resend strat- 
egy and entangle-ancilla strategy was proved. However, here 
we show that with the help of our intercept-resend strategy. 
Eve can obtain all of the data bits with probability i with- 
out being detected by the communication parties. For conve- 
nience, we use the same notations as in Ref.| IJJ]. 

The eavesdropping strategy is illustrated in Fig.(|3. Ac- 
cording to Fig.(|3, if Eve can transform the previously shared 
entangled state \GHZ)abc among Alice, Bob ad Charlie to 
|^i)aei |^i)6e2 I^i)ce3, then, shc Can take all of keys that Al- 
ice sends to Bob and Charlie, where |^i) are Bell states. Now 
let us give an explicit description of Eve's strategy. 

1) In the beginning, Alice, Bob and Charlie have a pervi- 
ously shared GHZ state which we denote by 



\G)ab 



V2 



(|000) + |lll))a6c 



(19) 



It can be shown that for every round of the protocol, Alice 
and Bob have a chance to detect Eve's operation. Although, 
GGWZ 1 24] attack still exists for this generalization, based on 
what we did in sec. Ill, we can use other states as carriers, to 
get secured against GGWZ attacks. 



and the data bits Alice wants to distribute to Bob and Charlie 
can be represented by gi , 92 , 93 , • ■ • , f?™ ■ 

2) Ahce prepares the state \qq) 12 (corresponding to classi- 
cal bit qi) and entangles this state to the already present GHZ 
state by performing CNOT gates CaiCa2 (as defined at the KB 



protocol (nil) on 

\G)abc\qq)l2 - 4f(|000) + |lll))abck,g)l2 (20) 

to produce the state 

l^odd^ = 1 (|000),b,|g, <z)i2 + |lll)afcc|'Z +1,9+ 1)12) 

(21) 

and she sends the coded state to Bob and Charlie. 

3) Eve intercepts first to send qubits and performs a mea- 
surement on them in the z bases (|0), |1)). Thus, the carrier 
state reduces to 



or 



^'"'^)i^\000)abc\q,q)l2 



\^°n2 = \in)abc\q+l,q+l)l2 



(22) 



(23) 



Then, she resends the encoded states to Bob and Charlie. Bob 
and Charlie act on this state by the operators Cbi and Cc2 
and extract the state \q,q) 12- At this moment, parties can 
not detect Eve's operation. In what follows, we only consider 
the \^°'^'^)i state (a similar approach can be consider for the 
l^odd^^ state). 

4) Alice, Bob and Charlie apply Hadamard operation H on 
the their particle states. Then, for the even bits, which are 
encoded as states \q), i.e., (|0) = (l/\/2)(|00) + |11) and 
|T) = (l/\/2)(|01) + |10)), Alice entangles this state to the 
shared state by performing only one single CNOT gate Cai on 
the 1^) to produce the state: 



1 



1 



1 



^ma\q) + |l)|al + 9»^(|0> + \^))b^(\^) + |l))c 

Alice sends the coded state to Bob and Charlie. 

5) Eve intercepts and keeps sending qubits to herself. Thus, 
she has shared the 1 0) a | g) + 1 1 ) 1 1 + g) „ state between herself 
and Ahce. 

6) Eve prepares two maximally entangled state (|00) + 
|11))34(|00) + |11))56 and sends qubits 4 and 6 to Bob and 
Charlie respectively. At this stage, the common state between 
them is: 

1 



V2 



i\0)a\q) + \l)\al + q)) 



xi(|0) + |1)),(|00) + |ll))34i(|0) + |1)).(|00) + |11))56 

7) Bob and Charlie take qubits 4 and 6 and act on the these 
states by operations Cb4 and Ccs- The common state can be 
writhen as: 

1 



V2 



(|0)Jg) + |l)JTT^» 



X2{(|00> + |11»63|0)4 + (|01) + |10))b3|l)4} 
X^{(|00) + |ll))e5|0)6 + (|01) + |10)),5|1)6} 



(a) 



/ 






Alice 




. L 


\ 






GHZ 




>».. 





FIG. 2: A F-type attack on BK protocol for quantum encryption 
of keys, (a) Alice, Bob ad Charlie previously shared entangled 
state \GHZ)abc among themselves, (b) Eve can transform pre- 
viously shared entangled state \GHZ)abc to three Bell states of 
|^i)aei |'I'i)6e2 1*1^1)063, amoug hcrself and parties, then, she can take 
all of keys that Alice sends to Bob and Charlie. 



8) Bob and Charlie do a measurement on the qubits 4 and 
6 in the z basis (|0), |1)), and identify these types of keys 
together. With the probability of one-half, the above state re- 
duces to: 

for q — Q 



(|0)a|0) + 


|l>a|l»(|00) 


+ |ll»b3(|00) 


+ |ll))c5 


(|0)a|0) + 


|l>a|l))(|01) 


+ |10))63(|01) 


+ |10))c5 


(|0)a|l) + 


|l>a|0))(|00) 


+ |ll»b3(|01) 


+ |10»c5 


(|0)a|l) + 


|l>a|0))(|01) 


+ |10))63(|00) 


+ |ll))c5 



Thus, Eve separately shares her qubit in a maximally entan- 
gled states with Alice's, Bob's and Charlie's. Before going 
to the next round of QKD, we would like attention following 
relation for the above states for q = Q,l, we have: 

H(g)H(g) H{\0)\0) + |1)|T)) = |000) + |111) 
H®H® H{\Q)\T) + |1)|0)) = |000) - |111) 
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and 



H®H{\0)\0) 
H(g)H{\0)\l) 



|1>|0» 



(100) 
(100) 



|11» 
|11» 



Thus, for odd sequence bits (73, (75, ... Eve gets the same bits 
that Alice sent (for each cases q — 0, 1). and for even se- 
quence bits q4,qQ, ... Eve gets the bits (74, ggj •■• (94 + 1, 96 + 
1, ... ) for q ~ 0{q ~ 1). On the other hand, Bob and Chariie 
get precisely the same sequence of bits that Alice sent for all 
rounds of the QKD. Although, after parties' communication 
in the general channel for test of security. Eve can recognize 
appropriate keys. This approach has an interesting property 
that Eve can get all of the secret keys with probability one 
half (the same as in the case of ZLG protocol). In other words, 
the probability doesn't increase with going from two to three 
parties. 

In what follows, we would like to repair the BK protocol by 
using higher dimensional GHZ states. The new protocol that 
we suggest is similar to our previous approach to the ZLG 
protocol. We consider a generalization of the GHZ state to 
a D dimensional system which was previously shared among 
the parties. This is the state define as: 



D-l 

odd\ _ ^ y^ 



1 



j"=0 



(24) 



Alice wants to send the sequence of classical bits qi,q2, ... 
{qi — 0, 1) to Bob and Charlie. She prepares the state \q, q)i2 
corresponding to qi and operates with controlled gates Uc{al) 
and Uc{a2) (previously defined at eq. iT2\ ) on them, to the get 
the state: 



I* 



odd\ 



1 



E 



= ^^\ y^ \j,JJ)abc\q,q) 



12 



+ E \J^J'J)abc\q + l,q + l) 



12 



(25) 



and she sends a coded state to Bob and Charlie. At the destina- 
tion. Bob and Charlie act on this state by the controlled gates 
Uc{bl) and Uc{c2) and extract the state \q,q)i2 (for further 
convenience, we restrict our selves to particles with even di- 
mension D = 2d). Hence, for the even bits which are encoded 
as state \q) (similar to BK protocol), parties apply Hadamard 
transformation to ZJ-dimensional GHZ state which we denote 
by 



7?(g)i/®iJ|* 



odd\ 



D-1 



= 1**= 



- Yl Mh,D)\h,l2,h)abc 



liMM=0 



In the above equation A(Zi, D) = '5(^j^-^ U) + ^(X)i=i ^i ^ 
D) + (5(X]Li ^i ~ 2-D). Thus, Alice entangles the state \q) to 



the shared state Y^i™'^^) by performing only one single con- 
trolled gate Uc{al) to produce: 



D-l 



D-l 



Y, Aih,D)\h,l2,h)abc\q) (26) 

','2,(3=0 
1 

+ J2 Mh,D)\h,l2j3)abc\qTl) 

lf''-l2,h=0 

At the destination. Bob and Charlie act on this state by the 
operators Uc{bl) and Uc{c2) and extract \q)i2. noting that 
H^ 7^ 1 for D > 2, Alice and Bob must operate H* in the 
next round of the protocol. 

If in the intermediate step of eq. ( I25t . Eve intercepts the 
first sending qubits and performs a measurement on them, 
then, the GHZ state reduces to: 



or 



1$. 



!<!>, 



n E 1^' 



J:J)abc 



odd/ 




\j,jj)abc 



(27) 



(28) 



If Alice, Bob and Charlie apply Hadamard gate on the their 
particle states, for example \(j)even), we have: 



H* (g>H* (g>H*\il;) 



D-l 

E 



A{hi,d)\hi, /i2, h, 



3/abc 



In the above equation 

r-\ ■ /^ I I /I r \ 



= SiEl.h,) 



siEt 



3d) 



Aih,,d) 

•^(Etl h^^d)+ J(Etl h^ - 2d) - 

S(^^^i hi — 4d) + S{J2i^i hi — 5d). Thus, Eve can't dis- 
entangled Alice, Bob and Charlie states and we deduce that 
F-attack doesn't apply to this approach It can be shown that 
for every round of the protocol, parties have a chance to de- 
tect Eve's operation. Eve can only entangle her state with 
Alice and Bob states and she wishes that after her operation, 
the parties, Alice, Bob and Charlie, can not detect her effects. 
This strategy is the same as the GGWZ L241 attack, we showed 
to be removable easily. 

One of interesting results of our extension is that our proto- 
col can simply be extended to higher dimension QKD between 
Alice , Bob and Charlie, by using quantum key encoding and 
decoding classical information. 



VIII. CONCLUSION 

In this Paper, we review ZLG, KBB and BK protocols for 
QKD via quantum encryption and show that these protocols 
are not secure. Thus, Eve has always a chance to be informed 
of her parties' keys without being detected by them. That is, 
we have shown that the security conditions are a necessary 
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condition but not a sufficient one, specially in the QKD with 
orthogonal states. 

For the sake of completeness we briefly described the be- 
havior of the presented schemes on efficiency of the transmis- 
sion. We consider the definition give by Cabello 1 151 . The 
efficiency of a QKD protocol, e, is defined as: 



(29) 



qt + h' 



where bs is the expected number of secret bits received by 
Bob, qt is the number of qubits used in the quantum chan- 
nel, and ht is the number of bits used in the classical channel 
between Alice and Bob. Since in our scheme no classical in- 
formation is needed in the message-coding, we have ht ~ 0. 
This together with &s = 1 and g* = 1 leads to e = 1. 

However, the practical efficiency takes into account chan- 
nel's transmittance as well fT^l. In our protocol (ZLG pro- 
tocol with higher dimensional Bell states) a qubit travels for 



a distance L, L being the separation between Alice and Bob. 
If r is the transmittance of the qubit over a distance L, after 
traveling the distance L and the operation of Bob, he takes 
measurement on the carrier particle. Thus, the practical effi- 
ciency can be evaluated as e' = er^ = r^. By comparison, 
in BB84 it is e' = (1/6)t, because bg = 0.5, qt = 1 and 
bt = 2, and a qubit travels a distance L. This implies that the 
presented scheme is more efficient than BB84, provided the 
transmittance of the channel is r > ^/T/6. It is also possible 
to see that ours practical efficiency is more efficient than M. 
Lucamarini and S. Mancini protoco l 1 1 ^ if t > ^/T/2 and 
that the entanglement-based scheme 11711 contains a factor t^, 
making it lower than ours 1251 . 
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